Before this change, any authenticated fft_ token could call GET /orgs, GET /orgs/{slug} and GET /orgs/{slug}/projects/{project}. They now need orgs:read for the first two and projects:read for the last. A token that only holds secrets:* and resolves its org or project first gets a 403 on that call.

What you need to do: add orgs:read and projects:read to tokens that look up their org or project before calling a product API. Existing tokens keep the scopes they were issued with.

orgs:write, projects:write and tokens:write now imply the matching read scope, the same way issues:write and secrets:write already do. A token with only orgs:write can GET /orgs/{slug}.